On 2021-08-20 07:56:33 -0700 (-0700), Russ Allbery wrote: [...] > Do you think using HTTPS makes security worse? [...] No, obviously not, except insofar that instilling a false sense of security can be harmful in the long term because it excuses people from thinking about the actual problems they're hoping to solve. > Personally, I think we should switch our default to HTTPS not > because we have a specific security flaw in mind against which > HTTPS provides some protection but because it's consistent with > the general message that a lot of us (including, for example, the > EFF and the IETF) are trying to send to average users who don't > have the expertise to analyze any of this: use TLS by default > wherever you can. Yes, this is a much nicer way of rephrasing it, but basically still what I said. Turning on HTTPS by default wouldn't be addressing any particular user risk, it would simply keep everyone from having to discuss and explain it ad nauseum. Much like replacing older hash functions for non-security-related checksumming: the potential for accidental collisions may not outweigh the engineering effort required to update applications or protocols, but the time developers will spend having to explain why they're using MD5 or SHA-1 hashes can be orders of magnitude greater still. -- Jeremy Stanley
Attachment:
signature.asc
Description: PGP signature